ce7e5acaae8712d242ab93e798f4916f698b2e8176647134d1a21daf6d7fdf54

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PC_ST/1. Check/4. OCCT.exe
Size

84.2MB
MD5

3753d2d63073ff1f9495f4f866ac6903
SHA1

85510f02d7d0c5f3c826e6c038a3e7186081c7c3
SHA256

4bc3fd9ba97c0a5210762681608f0a30aa2f829bf0a87ad5d1e6f922308744c6
SHA512

5b0b1099d1810124f71bb15a8395d98970470b12d86346cfc504c1c482976bdd5aa2f7b553513d081a30a2cbe55ba459ca1cd9533fcc6f57303e56fd73be7e38
SSDEEP

1572864:bPkD+a9I3WvDaf8jculVvBYiwtwN6Dbs08D1ixsQ4OvB1uuZa:wCl3WLa6wwYDuYWQ4iouZa

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Costura\61EC80E19D6079BB89E44006371EC7DF\64\hwinfo64.dll	upx
behavioral7/memory/2480-143-0x0000000180000000-0x00000001805DA000-memory.dmp	upx
behavioral7/memory/2480-285-0x0000000180000000-0x00000001805DA000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

4. OCCT.exe

pid process

2480 4. OCCT.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4. OCCT.exe

description pid process

Token: SeDebugPrivilege 2480 4. OCCT.exe

pid	process
2480	4. OCCT.exe

description	pid	process
Token: SeDebugPrivilege	2480	4. OCCT.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4. OCCT.exe

description	pid	process	target process
PID 2480 wrote to memory of 580	2480	4. OCCT.exe	WerFault.exe
PID 2480 wrote to memory of 580	2480	4. OCCT.exe	WerFault.exe
PID 2480 wrote to memory of 580	2480	4. OCCT.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PC_ST\1. Check\4. OCCT.exe
"C:\Users\Admin\AppData\Local\Temp\PC_ST\1. Check\4. OCCT.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2480 -s 880
2⤵
PID:580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Costura\61EC80E19D6079BB89E44006371EC7DF\simpleinjector.dll

Filesize
444KB

MD5
d9076eb96cc817079ee194645325e239

SHA1
8ac8449d2eaebe44e0064dbcff627eae673199d5

SHA256
d159cbb6cb43f0fab85c5794cbd2607458c2fb5cde83c98322320612f614a040

SHA512
b51cc4cde916b9228a8e7070358adf9b26082f641bd085a1c0b039b212765a8de81b45a0365d8097a7c415e220129b9d97fd4172ecf4d6e67b3241177268f48a

Download Submit
\Users\Admin\AppData\Local\Temp\Costura\61EC80E19D6079BB89E44006371EC7DF\64\hwinfo64.dll

Filesize
2.0MB

MD5
a7d32a687f69938255bf4a9d18701ae9

SHA1
7d003f8002b8ae7eb5ea84bdb105f6ad3cd75b38

SHA256
e41be021bc34cefee383df4fdf8c02cc2865fd209c4c3d8880173ce6164b9827

SHA512
6fe5e0454329226a0f31e3f1e66622bb62ecd68a36c7eeba208e4c41d142f31096f43eb05c9de448076f8584d6d78c708749b62ebfca3cf4d5edc68d5689372b

Download Submit
memory/2480-0-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

Filesize
4KB

Download
memory/2480-1-0x0000000000EE0000-0x000000000631A000-memory.dmp

Filesize
84.2MB

Download
memory/2480-142-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

Filesize
9.9MB

Download
memory/2480-143-0x0000000180000000-0x00000001805DA000-memory.dmp

Filesize
5.9MB

Download
memory/2480-282-0x0000000020050000-0x00000000200C6000-memory.dmp

Filesize
472KB

Download
memory/2480-285-0x0000000180000000-0x00000001805DA000-memory.dmp

Filesize
5.9MB

Download
memory/2480-287-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

Filesize
4KB

Download
memory/2480-288-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

Filesize
9.9MB

Download